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Figure 1 gives the agenda for the risk methodology 
overview. Before talking specifically about the carbon 
fiber risk methodology, I'd like to talk about risk methodology 
in general. We'll talk about some considerations of risk 
estimation, how risk is measured, and how risk analysis 
decisions are made. We'll then turn to the specific problem 
of carbon fiber release where I will review the objective, 
describe the main elements, and give an example of the 
risk logic and outputs. 
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Risk estimation involves a number of considerations, as out- 
lined in figure 2. Among these are the objective, the elements of 
the individual problem, the methods that are used, and how those 
methods are chosen and tested. Another consideration is whether 
the methods used are analytic or approximate; under "approximate" 
we're particularly interested in whether simulation is used. We 
are also concerned with what assumptions are made. For example, 
are all filters properly installed? How much carbon fiber is 
carried and by what types of planes? What kind of electronics 
will be used in 1993? Another component of risk estimation is 
scope. Under scope we are interested in both micro and macro 
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analysis. "Micro" and "macro" are used here as economic terms and 
mean "bottom up" and "top down," respectively. Micro refers to 
the details of the problem whereas macro refers more to an over- 
view. Mr. Ansel Butterfield gave a good example of a micro anal- 
ysis when he talked about the costing of industrial plants. An 
example of a macro analysis would be trying to cost a power outage 
resulting from the carbon fiber problem by using costs of power 
outages resulting from non carbon- fiber problems. Part of scope 
are the limits of the risk analysis. Limits are closely tied with 
assumptions. Two limits, for example, in the carbon fiber study 
are restriction to just the commercial part of civil aviation and 
to just single fibers. 

A major consideration in risk estimation is errors. Errors 
are involved in the elements, methods, assumptions, and scope. 

How these errors are defined and presented are two important parts 
of the problem. Sensitivity studies show, how variations in the 
elements affect the risk; in particular, they indicate which of 
the elements are the main contributors to the risk. A sensitivity 
study is done by varying only one parameter, or perhaps one group 
of the parameters, while holding all other elements fixed and re- 
calculating the risk for each variation of the parameter. Worst 
cases are usually important to present. Furthermore, if, as in 


160 


most risk analyses concerning rare events, simulation forms the 
basis of the methodology, the worst cases might not be obtained 
among the simulated cases and, hence, must be calculated 
separately. 

Figure 3 gives the units and format for risk measurement. 

The usual units are fatalities, injuries, dollars and complaints. 

As Mr. Heldenfels noted in his talk, fatalities and injuries are 
usually the most important units. However, as he also pointed 
out, they don't seem to be an issue in this problem. Complaints 
can't be ignored even though the dollars are small, and there 
are no fatalities or injuries. Because nearly all risk analyses 
involve probabilities which range from 0 to 1 , the main output is 
in terms of a curve instead of a point. Two types of curves that 
are coinmonly used are what are called density and cumulative curves 
and I will be giving examples of these later. Even though the main 
result is a curve it is usually important to have one or more sum- 
mary measures. Some of the typical types of summary measures are 
means, medians, modes, extremes, and various combinations of these 
four. Again, error bounds are usually important in any type of 
risk analysis, and they can be shown in various ways. 
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The main elements of risk decision are given in figure 4. 

The first job in decision making is defining the decision maker. 
Sometimes he is not specifically defined. Sometimes the decision 
maker is a body of people. The second job is determining the 
measures that are important to the decision maker. These mea- 
sures, or acceptability criteria, vary with the problem and with 
the decision maker. The first acceptability criterion usually 
concerns the actual values. If the risk curves have many ex- 
tremely large values or all very small values, the remaining 
acceptability criteria may not be important. Under "actual value" 
one is concerned with whether the value is direct or indirect. An 
example of a direct cost in the carbon fiber problem is equipment 
replacement and repair. An example of an indirect cost would be 
product loss, as Mr. Butterfield illustrated, resulting from 
equipment that has malfunctioned because of the carbon fiber 
problem. 
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Once we have analyzed the actual risk values, we are then 
interested in comparing these values with those from other types 
of risk. For example, how does the probability of failure to a 
stereo from the carbon fiber problem compare with the probability 
of failure to a stereo from all other causes. How does the 
carbon-fiber risk compare with other types of risk, for example, 
risks from floods, tornadoes, driving, and private flying. In 
making risk comparisons, two concerns are voluntary risk versus 
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involuntary risk. Voluntary risk is risk a person imposes upon 
himself. Involuntary risk is risk imposed upon the person. Ex- 
amples of voluntary risk are flying a private plane and driving 
an automobile. Involuntary risk is exampled by being a passenger 
in a commercial airplane. Needless to say, people are much more 
willing to accept voluntary risk than they are involuntary risk. 

We are also interested in comparing risk with benefits in terms 
of the curves and summary statistics. If the benefits greatly 
outweigh the risks, then the decision maker leans toward accep- 
tance of the risk. However, a benefit-risk comparison is never 
the sole criterion for decision making. If, for example, a pro- 
gram would have huge benefits but is such that there would be a 
high probability of destroying two cities, the program would 
not be accepted. 

Figure 5 gives an example of a risk comparison. This figure, 
which is called a risk profile, comes from a risk analysis of the 
operation of water-cooled nuclear power plants in the United 
States. This nuclear reactor safety study was commissioned by the 
United States Atomic Energy Commission and directed by Dr. Norman 
C. Rasmussen of M.I.T. The vertical axis gives the number of 
events per year exceeding various dollar damages that are shown on 
the horizontal axis. The curve for natural events is dominated by 
hurricanes. The second main contributor is tornadoes. The main 
component of the man-caused events is huge fires. Among other 
events are mine disasters and industrial explosions. The "100 
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nuclear power plants" means that the nuclear-plant population 
considered consists of 100 plants, rather than just one plant. 

That is, if the probability of one accident at one plant is "x" , 
then the probability of one accident out of a population of 100 
plants is 100 times "x" . 

The plot indicates that the damage from both at least one 
natural event, such as a hurricane, and one man-caused event, such 
as a large fire, can be expected to exceed $10 million once every 
year and $10 billion once every 1000 years. Equivalent damage 
from nuclear reactor accidents occurring within a population of 
100 nuclear plants is expected to happen much less frequently. 

Note that automobile accidents, which had about $15 billion in 
property damage when the three curves were constructed, were not 
included in the man-caused events. In a subsequent talk Dr. Joseph 
Fiksel of Arthur D. Little will compare the current risk profile 
for the carbon-fiber problem with the risk profiles shown in 
figure 5. 

As you heard previously, and as shown in figure 6, the first 
objective of the carbon fiber risk analysis is to estimate the 
risk to the nation over the next 15 years from the use of carbon 
fiber in civil aircraft. The methodology is a logical, systematic 
analysis that strives to reduce the subjectivity of the risk 
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estimate and of the errors associated with that estimate. The 
second objective is to provide a framework for decision making on 
material usage, material modification, and protection schemes. 

Note that other risk analyses have parallel objectives. Some of 
the more recent risk analyses are usage of seat belts in automo- 
biles, transportation and storage of liquified natural gas (LNG) , 
operation of water-cooled nuclear power plants - the study we just 
discussed for figure 5, comparison of transportation methods for 
oil so that spills are minimized, and mass vaccinations for the 
public; smallpox and swine flu being two examples. 

As shown in figure 7, the carbon-fiber risk-analysis elements 
can be described in terms of three levels. The first is the local 
level, which is some type of geographic subdivision of the United 
States. The second is the national level, given that you have an 
estimate of the risk on the local levels. The third level in- 
volves extrapolating the risk estimate from the national level into 
the future. As noted in a previous paper, we're using the next 
fifteen years 1978-1993 as the future. As you also heard previ- 
ously, some of the main elements on the local level are aircraft 
accident probability, dispersion of carbon fiber, transfer func- 
tion, vulnerability, and costing. On the national level some of 
the main elements are number of accidents per year and the location 
of these accidents. Among considerations for location are whether 
the accident sites are near mountains or large bodies of water and 
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what the population and electronic densities are. Some of the 
main elements on the future level are carbon fiber usage pro- 
jections, accident statistics changes, and technology changes. 

The next three figures are sequential illustrations of the 
logic for generating damage from an accident involving fire. 

This logic is an example of what is called an event tree or a 
decision tree. All our risk methodologists use some type of 
event tree like this one, although of much greater complexity and 
not necessarily in the sequence shown. Although this is a very 
simplified tree compared to what is actually used, at least one 
representation of each of the main elements of the carbon-fiber 
problem is included. The elements of the risk assessment under 
evaluation are identified across the bottom of the next three 
figures, that is: accident probability, source, dispersion 

transfer function, vulnerability, and costing. Across the top 
of the three figures are the data sources for these various 
elements: operation rates, accident records, weather records, 

census maps, experiments, surveys, and pathfinder studies. 
Calculations are made at each of the nodes. Some calculations 
involve analytic models; others, random selections. 

The first node, shown in figure 8, represents the occurrence 
of an accident involving fire. The second node represents the 
choice of the location for the accident. Air traffic in the 
United States can be represented by the traffic at the 26 large 
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hub airports with everything else lumped into all "other." The 
number in parenthesis approximately gives the number of opera- 
tions per airport. The airport selection is made by a random 
selection process. This selection process can be illustrated in 
the choice of the operational phase. Accident records show that 
fire accidents occur 25% of the time in take-off; 45%, in landing; 
15%, in cruise; and 15% in static or taxi operation. The selec- 
tion of the operational phase can be illustrated by use of a 
roulette wheel. Moving clockwise, assign the first 25% of the 
roulette wheel to take-off; assign the next 45% to landing; the 
next 15% to cruise; and the last 15% to taxi/static. The roulette 
wheel is therefore divided into four areas with proportions 
corresponding to the probability of an accident in take-off, land- 
ing, cruise, and static or taxi operation. For this example, a 
spin of the roulette wheel selects "cruise" as the operational 
phase. Although this is a very simple example, all random simu- 
lations are performed in a similar manner. The next node selects 
the type of damage. The type of damage determines, in part, the 
amount of fiber released. In this example "substantial" is 
selected using the random process based on statistics from acci- 
dent records. 

A similar random selection process is used to select the size 
of an aircraft, which affects source. The three aircraft size 
categories are shown in figure 9. The probability of an explosion 
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is also determined by random selection. The presence of an ex- 
plosion determines not only how much material is released, but 
how far it disperses. If there is an explosion, most of the 
material is likely to be contained within a 10-mile area. If 
there is not an explosion, much of the material can be dispersed 
as far away as 100 kilometers or more. One of the two explosion 
paths is chosen using the random process. The wind direction is 
determined by random selection from weather records for the loca- 
tion chosen in the first step. At this point, the use of the 
random selection processes is completed. The dispersion of re- 
leased carbon fibers can now be calculated based on an accident 
scenario constructed from probabilities derived from accident 
records, operational experience, and projections of the amount of 
carbon fiber to be used on aircraft in the future. The dispersion 
footprints, or isopleths of constant exposure, are related to spe- 
cific geographical locations. 

As illustrated in figure 10, by using a census map, with the 
various exposure isopleths superimposed, the areas of the city and 
countryside affected can be identified. The example in figure 10 
shows only three such areas: commercial, public (which could be 

post offices, hospitals, and fire stations), and residential. 

Given the areas affected, the next step is to determine transfer 
functions into the building types within each of these areas and 
the vulnerability of the various equipment types within each build 
ing type. Equipment examples are: computers in the commercial 
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districts, stereos and televisions in the residential areas, and 
telephone exchanges in the public area. Finally, the dollar loss 
is determined using impact surveys and pathfinder studies. Four 
examples of impact costs are repair or replacement of equipment, 
overtime, downtime, and product losses. The sum of these costs 
gives the cost impact from one accident. By using the historical 
five or six accidents a year involving fire, the random selection 
of nodes in the event tree and the cost calculation is repeated 
five or six times and the cost siammed to obtain one estimate of 
the national risk. However, one estimate is not enough to obtain 
a statistical distribution of estimates and, therefore, the cal- 
culations of the national risk must be repeated a large number of 
times . 

Suppose we repeat these calculations 1,000 times and that 
they give the results shown in figure 11. The first two columns 
of figure 11 give dollar values for a year's national costs, or 
damages, and the number of the 1,000 trials that had those 
dollar values. For example, the first line of the. first two 
columns gives that 50 of these 1,000 trials had zero costs. Per- 
haps very little fiber was released or perhaps all that was re- 
leased went over the water or into the countryside. The last line 
gives one case that had a very high cost. Perhaps this case 
resulted from use of a jumbo plane and carbon-fiber release over 
highly industrialized areas. 
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From the first two columns of numbers, we calculate a den- 
sity function, with values given in the third column, by simply 
taking the number of trials that have a certain yearly national 
cost and dividing that number by 1,000. Note that, to simplify 
the example, all numbers in figure 11 are rounded off and grouped 
into only seven categories; in reality, of course, there are 
hundreds, perhaps thousands, of categories. The fourth column 
gives the product of the second and third columns. This column 
weighs the dollar costs by the frequency with which they occur. 
Summing up these dollar costs gives the expected value, which is 
the most common summary statistic used in risk analyses. The ex- 
pected national value of $103,400 in this example is very small, 
especially with respect to the extreme of $10 million. In this 
example, there is a very high frequency of middle and small costs 
that tend to drown out the very large costs. 

Some of the other types of summary risk measurements are the 
median cost, which is $100,000»and the extremes, which are $0 and 
$10 million. A particular interest is the frequency with which 
the upper extreme occurs. One way of looking at this .001 fre- 
quency is to say that roughly every one in a thousand years a 
$10 million national cost can be expected. The last column gives 
the cumulative probability, which is the basis of the most fre- 
quently used type of curve in risk analyses. This column is ob- 
tained by simply cumulating the probability given in the third 
column. For example, the bottom values of 0.001 are the same. 

The next-to-bottom cumulative probability is obtained by adding 
the two bottom density probabilities of 0.001 and 0.003. 

In figure 12, these cumulative probabilities have been 
plotted to give a risk profile. The ordinate gives the values 
from the last column of figure 11. The abscissa gives property 
damage in dollars. Note that the curve is plotted on a log scale. 
The error bounds in this illustrative problem are equally weighed 
except when they're bounded by one. 

Figure 13 gives several summary points about the capability 
of risk analysis methodology. First, risk methodology integrates 
the data and engineering judgment into a logical framework. 

Second, it combines both deterministic and probabilistic models. 
Third, it permits sensitivity analyses of key assessments. Two 
examples are the carbon fiber usage projections and the nature of 
released fiber; in particular, the fall rate. For example, what 
are the effects from single fibers versus those from lint or 
clumps. Finally, risk methodology permits evaluation for alter- 
native sources, where alternative sources might be exampled by 
general aviation or helicopters in civil aircraft or by other 
types of sources such as automobiles. 
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SUMMARY 
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